================================================================== BUG: KASAN: slab-use-after-free in hlist_add_head include/linux/list.h:1026 [inline] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0 drivers/android/binder.c:6932 Write of size 8 at addr ffff8880135ffc08 by task syz-executor/6885 CPU: 2 UID: 0 PID: 6885 Comm: syz-executor Not tainted 6.15.0-syzkaller-10954-gd00a83477e7a #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xcd/0x680 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 hlist_add_head include/linux/list.h:1026 [inline] binder_add_device+0xa4/0xb0 drivers/android/binder.c:6932 binderfs_binder_device_create.isra.0+0xa03/0xc30 drivers/android/binderfs.c:210 binderfs_fill_super+0x8d4/0x1360 drivers/android/binderfs.c:730 vfs_get_super fs/super.c:1323 [inline] get_tree_nodev+0xda/0x190 fs/super.c:1342 vfs_get_tree+0x8b/0x340 fs/super.c:1802 do_new_mount fs/namespace.c:3856 [inline] path_mount+0x14d4/0x1f70 fs/namespace.c:4180 do_mount fs/namespace.c:4193 [inline] __do_sys_mount fs/namespace.c:4404 [inline] __se_sys_mount fs/namespace.c:4381 [inline] __ia32_sys_mount+0x28b/0x310 fs/namespace.c:4381 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f82579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000fff1fa10 EFLAGS: 00000296 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 00000000f72a64ed RCX: 00000000f7296be3 RDX: 00000000f72a64ed RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000f7274088 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 6928: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] drm_atomic_helper_setup_commit+0x63a/0x15d0 drivers/gpu/drm/drm_atomic_helper.c:2326 drm_atomic_helper_commit+0xa9/0x380 drivers/gpu/drm/drm_atomic_helper.c:2061 drm_atomic_commit+0x231/0x300 drivers/gpu/drm/drm_atomic.c:1577 drm_client_modeset_commit_atomic+0x69d/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1101 drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1204 pan_display_atomic drivers/gpu/drm/drm_fb_helper.c:1387 [inline] drm_fb_helper_pan_display+0x32d/0xa40 drivers/gpu/drm/drm_fb_helper.c:1447 fb_pan_display+0x479/0x7d0 drivers/video/fbdev/core/fbmem.c:191 fb_set_var+0x860/0x1260 drivers/video/fbdev/core/fbmem.c:323 fbcon_resize+0x684/0x910 drivers/video/fbdev/core/fbcon.c:2075 resize_screen drivers/tty/vt/vt.c:1112 [inline] vc_do_resize+0xccb/0x10e0 drivers/tty/vt/vt.c:1169 vt_resizex drivers/tty/vt/vt_ioctl.c:717 [inline] vt_ioctl+0x24ce/0x2f50 drivers/tty/vt/vt_ioctl.c:937 vt_compat_ioctl+0x237/0x4e0 drivers/tty/vt/vt_ioctl.c:1108 tty_compat_ioctl+0x2f1/0x4d0 drivers/tty/tty_io.c:2981 __do_compat_sys_ioctl fs/ioctl.c:1005 [inline] __se_compat_sys_ioctl fs/ioctl.c:948 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:948 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Freed by task 6966: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4841 kref_put include/linux/kref.h:65 [inline] drm_crtc_commit_put include/drm/drm_atomic.h:555 [inline] __drm_atomic_helper_plane_destroy_state+0x1bb/0x1f0 drivers/gpu/drm/drm_atomic_state_helper.c:399 __drm_gem_destroy_shadow_plane_state drivers/gpu/drm/drm_gem_atomic_helper.c:277 [inline] drm_gem_destroy_shadow_plane_state+0x21/0x30 drivers/gpu/drm/drm_gem_atomic_helper.c:296 drm_atomic_state_default_clear+0x69e/0xe40 drivers/gpu/drm/drm_atomic.c:244 drm_atomic_state_clear drivers/gpu/drm/drm_atomic.c:293 [inline] __drm_atomic_state_free+0x185/0x2b0 drivers/gpu/drm/drm_atomic.c:310 kref_put include/linux/kref.h:65 [inline] drm_atomic_state_put include/drm/drm_atomic.h:588 [inline] drm_client_modeset_commit_atomic+0x6b2/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1107 drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1204 drm_client_modeset_commit+0x4f/0x80 drivers/gpu/drm/drm_client_modeset.c:1230 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:237 [inline] __drm_fb_helper_restore_fbdev_mode_unlocked+0x19f/0x200 drivers/gpu/drm/drm_fb_helper.c:216 drm_fb_helper_set_par+0xd8/0x120 drivers/gpu/drm/drm_fb_helper.c:1359 fb_set_var+0x838/0x1260 drivers/video/fbdev/core/fbmem.c:312 fbcon_resize+0x684/0x910 drivers/video/fbdev/core/fbcon.c:2075 resize_screen drivers/tty/vt/vt.c:1112 [inline] vc_do_resize+0xccb/0x10e0 drivers/tty/vt/vt.c:1169 vt_resizex drivers/tty/vt/vt_ioctl.c:717 [inline] vt_ioctl+0x24ce/0x2f50 drivers/tty/vt/vt_ioctl.c:937 vt_compat_ioctl+0x237/0x4e0 drivers/tty/vt/vt_ioctl.c:1108 tty_compat_ioctl+0x2f1/0x4d0 drivers/tty/tty_io.c:2981 __do_compat_sys_ioctl fs/ioctl.c:1005 [inline] __se_compat_sys_ioctl fs/ioctl.c:948 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:948 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e The buggy address belongs to the object at ffff8880135ffc00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes inside of freed 512-byte region [ffff8880135ffc00, ffff8880135ffe00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x135fc head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b442c80 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b442c80 0000000000000000 dead000000000001 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffea00004d7f01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5994, tgid 5994 (kworker/u32:3), ts 48233532304, free_ts 20733960132 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704 prep_new_page mm/page_alloc.c:1712 [inline] get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669 __alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419 alloc_slab_page mm/slub.c:2450 [inline] allocate_slab mm/slub.c:2618 [inline] new_slab+0x23b/0x330 mm/slub.c:2672 ___slab_alloc+0xd9c/0x1940 mm/slub.c:3858 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3948 __slab_alloc_node mm/slub.c:4023 [inline] slab_alloc_node mm/slub.c:4184 [inline] __kmalloc_cache_noprof+0xfb/0x3e0 mm/slub.c:4353 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tomoyo_find_next_domain+0xfd/0x20b0 security/tomoyo/domain.c:710 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline] tomoyo_bprm_check_security+0x12e/0x1d0 security/tomoyo/tomoyo.c:92 security_bprm_check+0x1b9/0x1e0 security/security.c:1302 search_binary_handler fs/exec.c:1655 [inline] exec_binprm fs/exec.c:1697 [inline] bprm_execve fs/exec.c:1749 [inline] bprm_execve+0x810/0x1650 fs/exec.c:1725 kernel_execve+0x2ef/0x3b0 fs/exec.c:1915 call_usermodehelper_exec_async+0x255/0x4c0 kernel/umh.c:109 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page last free pid 5354 tgid 5354 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1248 [inline] __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706 rcu_do_batch kernel/rcu/tree.c:2576 [inline] rcu_core+0x79c/0x14e0 kernel/rcu/tree.c:2832 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Memory state around the buggy address: ffff8880135ffb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880135ffb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880135ffc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880135ffc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880135ffd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 10 06 adc %al,(%rsi) 2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 6: 10 07 adc %al,(%rdi) 8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi c: 10 08 adc %cl,(%rax) e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 1e: 00 51 52 add %dl,0x52(%rcx) 21: 55 push %rbp 22: 89 e5 mov %esp,%ebp 24: 0f 34 sysenter 26: cd 80 int $0x80 * 28: 5d pop %rbp <-- trapping instruction 29: 5a pop %rdx 2a: 59 pop %rcx 2b: c3 ret 2c: 90 nop 2d: 90 nop 2e: 90 nop 2f: 90 nop 30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi